Inbound Email: EML Attachment Not Parsing sometimes

RaginiP
Tera Contributor
This is the out‑of‑the‑box Script Include EmailUserReportedPhishing. Sometimes it is unable to parse the data. It creates the phishing email record, but the data is not parsed correctly—we are unable to see the proper body content in the phishing email record, and the subject is also not being fetched correctly. What could be the reason?

 

RaginiP_0-1771248243366.png

 

need assistance on this. Thanks in advance

 

2 REPLIES 2

Rohit Ladda
Tera Contributor

Is this happening for all emails or just specific ones? Is language internationalization plugin enabled on this instance?

Terry_Yeti
Giga Expert

I ran your intermittent EML attachment parsing issue through SnowCoder AI. This is a known pain point with inbound email processing in ServiceNow, and there are several factors that can cause EML attachments to fail parsing inconsistently.

## Common Causes and Solutions

### 1. Email Size and Content Filtering Properties

ServiceNow has properties that control how inbound email attachments (including embedded EML files) are processed. If the EML contains inline images or nested content, it can hit filtering thresholds inconsistently depending on the email content.

Check and adjust these properties:

- **`glide.email.inbound.max_attachment_size`** - If some EML files are larger than others, they may exceed this limit silently.
- **`glide.email.inbound.image_size_minimum_for_attachment`** - As noted in PRB1778099, image filtering can strip out content from attachments. If the EML contains embedded images below the minimum size threshold, the parsing behavior can vary.
- **`glide.email.inbound.max_body_size`** - Nested EML body content can exceed this, causing partial or failed parsing.

Navigate to **sys_properties.list** and review these values:

```
glide.email.inbound.max_attachment_size = 20971520 // 20MB, increase if needed
glide.email.inbound.image_size_minimum_for_attachment = 12000 // in bytes
```

### 2. RTF / Encoding Issues

Some EML files are encoded differently depending on the originating mail client. Outlook in particular can produce RTF-encoded content or winmail.dat wrappers that ServiceNow struggles with. If the EML attachments that fail are coming from specific senders or mail clients, this is likely the culprit.

### 3. Check the Inbound Email Logs

Run this to identify patterns in the failures:

```javascript
var gr = new GlideRecord('sys_email');
gr.addQuery('type', 'received');
gr.addQuery('state', 'error'); // or 'ignored'
gr.orderByDesc('sys_created_on');
gr.setLimit(50);
gr.query();
while (gr.next()) {
gs.info('Email ID: ' + gr.getUniqueValue() +
' | Subject: ' + gr.getValue('subject') +
' | Error: ' + gr.getValue('error_string') +
' | Content Type: ' + gr.getValue('content_type'));
}
```

Also check **sys_email_log** for more granular processing details on the specific emails that failed.

### 4. Inbound Action Configuration

If you have a custom inbound action that processes EML attachments, make sure it handles the attachment stream correctly. The intermittent nature often comes from the `GlideTextReader` hitting null on certain line reads when the EML has binary content mixed in:

```javascript
var sa = new GlideSysAttachment();
var attachments = sa.getAttachments('sys_email', emailSysId);
while (attachments.next()) {
var fileName = attachments.getValue('file_name');
if (fileName.endsWith('.eml')) {
// Use getContentStream instead of getContent for reliability
var stream = sa.getContentStream(attachments.getUniqueValue());
if (stream) {
// Process the stream
gs.info('Successfully read EML: ' + fileName);
} else {
gs.warn('Failed to get content stream for: ' + fileName);
}
}
}
```

### 5. Quick Diagnostic Steps

1. Compare a **working** inbound email with a **failing** one in the sys_email table. Look at content_type, body size, and attachment count.
2. Check if the failures correlate with emails from a specific domain or mail client.
3. Review **System Logs > Emails** for any "send-ignored" or error states on the failing records (reference KB0790932 for ignored patterns).
4. Enable the debug property `glide.email.inbound.debug=true` temporarily to capture verbose logs during the next failure.

### Recommended Fix

In most intermittent cases I have seen, the root cause is either the image/attachment size filtering stripping nested EML content, or an encoding mism

_______________________________________
I used snowcoder ai to generate this. If you need to tweak the requirements, you can run it through their Yeti AI for free.